A search result isn't always safe. An access request isn't always harmless. And a familiar account doesn't always mean a familiar person is using it. Simple things to remember. Yet a surprising amount of this week's trouble starts right there. Attackers are using fake websites, stolen access, and trusted tools to get into places they shouldn't be. AI is helping them build attacks faster, while also giving them new systems to target. Some intruders are staying hidden even after security holes are fixed. Others are moving stolen money through a maze of transactions. And researchers keep finding small coding mistakes that can cause much bigger problems.
Different stories, but much of the trouble comes down to making something dangerous look normal. There is some good news, too. Criminal servers have been seized, and a few defenses are getting stronger. Still, plenty of things are going wrong in ways that shouldn't be this easy. Here's what turned up this week.
North Korea's crypto laundering network
How North Korea Is Laundering $6.43B Stolen from Binance. The North Korean threat actors linked to the record-breaking theft of $6.43 billion from Binance are using a highly complex and clearly automated method to launder the illicit proceeds. "Since the theft it has used more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions," Dr. Tom Robinson, Elliptic's founder and chief scientist, said. "Around $3.0 billion remains in addresses linked to the theft, mostly as ETH and BTC. A negligible amount has likely been cashed out."
The attackers have also been observed creating six meme coins on the NEAR blockchain network (FUK, OLCCL, MEILI, MMLI, DABI, and SINU) to launder a slice of the ill-gotten funds, passing through about $430,000 of the stolen cryptocurrency. The goal is to disguise the path of money and make it harder to trace where the assets eventually end up. Other tactics used to make funds tracing more difficult include moving between blockchains through bridges and cross-chain swap services, swapping between assets on DEXs, hopping through lending vaults and liquid-staking services, and mixing bitcoin through coinjoins, and ETH and SOL through the Privacy Cash privacy pool.
GSocket detections surge 356%
Attacks Leveraging GSocket Spike in 2026. Microsoft said it has observed multiple incidents in which threat actors deployed GSocket, an open-source remote access tool, on internet-facing Linux servers to maintain access after the original vulnerabilities were addressed, turning a single web application compromise into persistent access. "Because GSocket relays traffic through a shared public network, there is no threat actor-owned IP address or domain to block," Microsoft said. "Defenders should look for GSocket deployment, persistence, privilege escalation, and outbound connections on affected hosts, not treat application patching alone as complete remediation." According to telemetry data, devices with GSocket-related detections increased 356.2% from March through August 2026, with most of them associated with PHP web applications, cPanel hosts, and Apache.
235 servers seized in Europol takedown
Europol Operation Dismantles GootLoader, CastleRAT, and StealC Infrastructure. Europol, along with global partners, has disrupted the criminal infrastructure behind GootLoader, CastleRAT, and StealC malware, seizing 235 servers and 257 domains. "The operation targeted 'cybercrime-as-a-service' models, where these tools enabled further crimes like ransomware attacks and data theft," Europol said. As part of the operation, authorities have identified over 6 million victim credentials.
Browser-based espionage targets governments
Hackers Deploy Falcon Browser Spyware to Monitor Government Emails and Steal Passwords. A command and control (C2) framework called Falcon (aka XG or Xiàng Gē) has been found compromising victims' browsers by running malicious JavaScript. Falcon shares near-identical URL structures, payload delivery mechanisms and communication protocols with PeckBirdy, another JavaScript C2 framework that came to light early this year. It's assessed that Falcon and PeckBirdy represent variants of the same core framework.
59 Linux kernel bugs uncovered
Microsoft Flags 59 Linux Kernel Bugs. Microsoft said its scan of a subset of Linux kernel subsystems from late May to mid-June 2026 unearthed 26,502 raw findings using MDASH, which subsequently formed the basis for 59 public upstream reports and 33 assigned CVEs. This includes working root privilege-escalation exploits for eight of those CVEs, such as CVE-2026-64563.
AI-assisted espionage in Central Asia
Silent Lynx Hackers Use AI Agent to Steal 2,000+ Tajik Government Documents. An exposed Silent Lynx server has uncovered cyber espionage operations targeting Central Asian governments and critical infrastructure from April to October 2026.
Contractor access fuels ransomware attacks
Citrus Ransomware Hackers Abuse Contractor Access, VLESS Tunnels, and AI-Generated Scripts. A new Russian-speaking ransomware group called Citrus is targeting Windows systems in corporate environments. The ransomware is a Sn00py-family ransomware variant written in Go. On Windows systems, the malware encrypts user files and appends the .citrus extension.
